Disclosure of Invention
The technical problem solved by the present disclosure is how to configure the access device quickly and automatically, and at the same time, improve the security of device access.
According to an aspect of an embodiment of the present disclosure, there is provided a device connection method including: the access equipment sends a dynamic host configuration protocol request to the management and control equipment; the management and control equipment sends a dynamic host configuration protocol response to the access equipment, wherein the dynamic host configuration protocol response comprises an IP address of the access equipment and an IP address of the management and control equipment; the access equipment sends an access message to the management and control equipment by using the IP address of the management and control equipment, wherein the access message comprises the IP address, the service port, the manufacturer identification, the equipment model, the equipment unique identification and the authentication identification of the access equipment; the management and control equipment authenticates the access equipment by utilizing the pre-configured registration information and the manufacturer identification, the equipment model and the equipment unique identification; under the condition that authentication is successful, the management and control equipment queries pre-configured authentication information by using the authentication identifier and the manufacturer identifier to obtain a user name and a password; the management and control equipment is connected with the access equipment by using the IP address and the service port of the access equipment.
In some embodiments, the IP address of the policing device is carried in the dhcp answer via dhcp options.
In some embodiments, the device connection method further comprises: the management and control equipment is configured with registration information in advance, and the registration information comprises a manufacturer identifier, an equipment model and an equipment unique identifier of factory-delivered access equipment; the management and control equipment is configured with authentication information in advance, and the authentication information comprises an authentication identifier, a manufacturer identifier, a user name and a password.
In some embodiments, the device connection method further comprises: the management and control equipment monitors the access message so as to authenticate the access equipment by using the access message after monitoring the access message.
In some embodiments, the device connection method further comprises: and the management and control equipment sends an access refusing message to the access equipment under the condition of authentication failure.
According to another aspect of the embodiments of the present disclosure, there is provided an apparatus connection system, including an access apparatus and a management and control apparatus; wherein the access device is configured to: sending a dynamic host configuration protocol request to the management and control equipment; the policing device is configured to: sending a dynamic host configuration protocol response to the access equipment, wherein the dynamic host configuration protocol response comprises an IP address of the access equipment and an IP address of the management and control equipment; the access device is further configured to: sending an access message to the management and control equipment by using the IP address of the management and control equipment, wherein the access message comprises the IP address, the service port, the manufacturer identifier, the equipment model, the equipment unique identifier and the authentication identifier of the access equipment; the policing device is further configured to: authenticating the access equipment by using the pre-configured registration information and the manufacturer identification, the equipment model and the equipment unique identification; under the condition of successful authentication, inquiring pre-configured authentication information by using the authentication identifier and the manufacturer identifier to obtain a user name and a password; and connecting the access equipment by using the IP address and the service port of the access equipment.
In some embodiments, the IP address of the policing device is carried in the dhcp answer via dhcp options.
In some embodiments, the regulating device is further configured to: pre-configuring registration information, wherein the registration information comprises a manufacturer identifier, an equipment model and an equipment unique identifier of factory-delivered access equipment; and configuring authentication information in advance, wherein the authentication information comprises an authentication identifier, a manufacturer identifier, a user name and a password.
In some embodiments, the regulating device is further configured to: and monitoring the access message so as to authenticate the access equipment by using the access message after monitoring the access message.
In some embodiments, the regulating device is further configured to: and in case of authentication failure, sending a message of refusing access to the access equipment.
According to still another aspect of the embodiments of the present disclosure, there is provided a device connecting apparatus including: a memory; and a processor coupled to the memory, the processor configured to perform the aforementioned device connection method based on instructions stored in the memory.
According to still another aspect of the embodiments of the present disclosure, there is provided a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the instructions, when executed by a processor, implement the aforementioned device connection method.
The method and the device realize automatic discovery, automatic authentication and automatic authentication of the access equipment, can rapidly and automatically configure the access equipment, and can improve the safety of equipment access.
Other features of the present disclosure and advantages thereof will become apparent from the following detailed description of exemplary embodiments thereof, which proceeds with reference to the accompanying drawings.
Detailed Description
The technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure, and it is obvious that the described embodiments are only a part of the embodiments of the present disclosure, and not all of the embodiments. The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the disclosure, its application, or uses. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure.
The inventors have summarized the technical drawbacks of the related art: (1) equipment access is realized through IP address scanning or broadcasting, and the efficiency and the safety are low; (2) the extra heavyweight protocol is introduced for support, so that the development workload of a management and control party and a manufacturer is increased, and the burden of access equipment is increased; (3) the part of the method lacks a link of authentication and signing, and the safety is low; (4) the connection direction between the access device and the management and control device leads the related technology to be applicable to partial application scenarios.
Some embodiments of the disclosed device connection method are first described in conjunction with fig. 1.
Fig. 1 illustrates a flow diagram of a device connection method of some embodiments of the present disclosure. As shown in fig. 1, the present embodiment includes steps S102 to S112.
In step S102, the access device sends a dhcp request to the policing device.
The access device may be, for example, an access-type optical transport network device. After the access equipment is powered on, the IP address and DNS information of the access equipment can be acquired through a dynamic host configuration protocol.
In step S104, the management and control device sends a dhcp reply to the access device, where the dhcp reply includes an IP address of the access device and an IP address of the management and control device.
In some embodiments, the IP address of the policing device is carried in the dynamic host configuration protocol reply by a dynamic host configuration protocol Option (DHCP Option).
In step S106, the access device sends an access packet to the management and control device by using the IP address of the management and control device, where the access packet includes the IP address of the access device, the service port, the manufacturer identifier, the device model, the device unique identifier, and the authentication identifier.
The message fields in the access message may be, for example, as shown in table 3.
TABLE 3
An example of an access packet is as follows:
192.168.1.101#830#huawei#1800I#F9C7A5E6E7A8#A1。
in step S108, the management and control device authenticates the access device with the manufacturer identifier, the device model, and the device unique identifier using the pre-configured registration information.
The registration information may be specifically shown in table 1, for example.
TABLE 1
During authentication, the management and control equipment analyzes the access message, verifies whether the unique identifier of the equipment has registration in the registration information, and further verifies whether the manufacturer identifier is matched and the equipment model is matched.
In case the authentication fails, step S110 is performed. In step S110, the policing device sends a rejection message to the access device.
In case the authentication is successful, step S112 is performed. In step S112, the management and control device queries the pre-configured authentication information by using the authentication identifier and the manufacturer identifier, and obtains a user name and a password.
The authentication information may be specifically shown in table 2, for example. The management and control system presets authentication information agreed with each manufacturer, and each manufacturer is different.
TABLE 2
| Authentication mark | Manufacturer identification | User name | Cipher code |
| A1 | Huawei | User name 1 | Code 1 |
| A2 | FiberHome | User name 2 | Cipher 2 |
For example, the management and control device authenticates and discovers a legal access device, and exchanges an authentication user name HuaweiUser1 and a password HuaweiPwd1 with an authentication identifier a1 and a manufacturer identifier Huawei in an access message.
In step S114, the management and control device connects the access device using the IP address and the service port of the access device.
If the connection is successful, the access equipment is marked to be legal, and if the connection is failed, the management and control equipment can send out alarm information.
In the conventional device access method, the configuration work of the client side access device is complicated, the management of the access device can be realized only by manually configuring the access device side and the management and control device side through a network management system or network management personnel, and the method is low in efficiency and easy to make mistakes. In addition, when the equipment is old or needs to be replaced when the equipment is failed, the access equipment often needs to be reconfigured, so that the maintenance cost of an operator is increased.
In comparison, the embodiment can realize automatic discovery, automatic authentication and automatic authentication after the access device is powered on, can quickly and automatically configure the access device, can also realize automatic recovery of services, can remove the complex steps of manual configuration, and saves a large amount of labor cost.
Meanwhile, the embodiment utilizes the TCP protocol originally supported by the equipment end, the message is simple and clear, and the control equipment and the manufacturer can realize the control without adopting an additional protocol, so the implementation is easy. The authentication information adopts the authentication identification to replace a plaintext password form, so that the plaintext password can be prevented from being intercepted and utilized, and the safety and the reliability of equipment access are improved.
In addition, in subsequent service management, different configuration parameters can be issued according to different equipment types and matched with the service template, so that service opening can be completed more efficiently and conveniently, and labor cost is further saved.
In some embodiments, the device connection method in this embodiment further includes step S105. In step S105, the management and control device monitors the access packet, so as to authenticate the access device by using the access packet after monitoring the access packet.
In some embodiments, the device connection method in this embodiment further includes step S101.
In step S101, the management and control device configures registration information in advance, where the registration information includes a manufacturer identifier, a device model, and a device unique identifier of a factory-delivered access device; the management and control equipment is configured with authentication information in advance, and the authentication information comprises an authentication identifier, a manufacturer identifier, a user name and a password.
It will be understood by those skilled in the art that the present disclosure may be applied to the management of optical transport network wavelength division devices in the field of optical transmission, not only to the management of optical transport network devices, but also to the management of other devices requiring additional authentication information. The netconf protocol can be adopted in the method, other protocols can also be adopted, and the method is suitable for a management protocol in which all access equipment is used as a protocol server side and management and control equipment is used as a client side.
Some embodiments of the disclosed device connection system are described below in conjunction with fig. 2.
Fig. 2 illustrates a schematic structural diagram of a device connection system according to some embodiments of the present disclosure. As shown in fig. 2, thedevice connection system 20 in the present embodiment includes an access device 201 and a management device 202. Wherein the access device 201 is configured to: sending a dynamic host configuration protocol request to the policing device 201; the policing device 201 is configured to: sending a dynamic host configuration protocol response to the access device 201, where the dynamic host configuration protocol response includes an IP address of the access device 201 and an IP address of the management and control device 201; the access device 201 is further configured to: sending an access message to the management and control device 201 by using the IP address of the management and control device 201, where the access message includes the IP address, the service port, the manufacturer identifier, the device model, the device unique identifier, and the authentication identifier of the access device 201; the policing device 201 is further configured to: authenticating the access equipment 201 by using the pre-configured registration information and the manufacturer identification, the equipment model and the equipment unique identification; under the condition of successful authentication, inquiring pre-configured authentication information by using the authentication identifier and the manufacturer identifier to obtain a user name and a password; the access device 201 is connected using the IP address and service port of the access device 201.
In some embodiments, the IP address of the policing device 201 is carried in the dhcp reply by dhcp option.
In some embodiments, the policing device 201 is further configured to: pre-configuring registration information, wherein the registration information includes a manufacturer identifier, an equipment model and an equipment unique identifier of the factory-delivered access equipment 201; and configuring authentication information in advance, wherein the authentication information comprises an authentication identifier, a manufacturer identifier, a user name and a password.
In some embodiments, the policing device 201 is further configured to: and monitoring the access message so as to authenticate the access device 201 by using the access message after monitoring the access message.
In some embodiments, the policing device 201 is further configured to: in case of authentication failure, a denial of access message is sent to the access device 201.
The embodiment can realize automatic discovery, automatic authentication and automatic authentication after the access equipment is powered on, can quickly and automatically configure the access equipment, can also realize automatic recovery of services, can remove the complicated steps of manual configuration, and saves a large amount of labor cost.
Meanwhile, the embodiment utilizes the TCP protocol originally supported by the equipment end, the message is simple and clear, and the control equipment and the manufacturer can realize the control without adopting an additional protocol, so the implementation is easy. The authentication information adopts the authentication identification to replace a plaintext password form, so that the plaintext password can be prevented from being intercepted and utilized, and the safety and the reliability of equipment access are improved.
An example of the application of the device connection system is as follows.
The equipment connecting system comprises a management and control equipment and an access equipment. The access device may include an addressing module, an information sending module, and a Protocol interaction module, and the management and control device may include a DHCP (Dynamic Host Configuration Protocol) module, a monitoring module, an authorization module, and a device management module. FIG. 3 shows the call relationship between modules:
(1) the addressing module acquires an IP of the access equipment and an IP address of the management and control equipment through the DHCP module;
(2) the information sending module organizes the access message according to a preset standard and sends the access message to the monitoring module;
(3) the monitoring module submits the access message to the signing module for legality judgment;
(4) the signing module submits the related information to the equipment management module under the condition that the equipment is legal;
(5) the device management module realizes the connection and management of the device.
Some embodiments of the apparatus attachment devices of the present disclosure are described below in conjunction with fig. 4.
Fig. 4 shows a schematic structural diagram of a device connection apparatus according to some embodiments of the present disclosure. As shown in fig. 4, thedevice connecting apparatus 40 of this embodiment includes: amemory 410 and aprocessor 420 coupled to thememory 410, theprocessor 420 configured to perform the device connection method of any of the foregoing embodiments based on instructions stored in thememory 410.
Memory 410 may include, for example, system memory, fixed non-volatile storage media, and the like. The system memory stores, for example, an operating system, an application program, a Boot Loader (Boot Loader), and other programs.
Thedevice connection apparatus 40 may further include an input-output interface 430, anetwork interface 440, astorage interface 450, and the like. Theseinterfaces 430, 440, 450 and the connection between thememory 410 and theprocessor 420 may be, for example, via abus 460. The input/output interface 430 provides a connection interface for input/output devices such as a display, a mouse, a keyboard, and a touch screen. Thenetwork interface 440 provides a connection interface for various networking devices. Thestorage interface 450 provides a connection interface for external storage devices such as an SD card and a usb disk.
The present disclosure also includes a computer readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the device connection method in any of the foregoing embodiments.
The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the disclosure. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The above description is only exemplary of the present disclosure and is not intended to limit the present disclosure, so that any modification, equivalent replacement, or improvement made within the spirit and principle of the present disclosure should be included in the scope of the present disclosure.